Hacker News Reader

It's heavily used where you need performance, for example crypto.

https://github.com/golang/go/tree/master/src/crypto/internal...

My understanding is that for crypto specifically it constant-time algorithms matter due to security implications, and those are only available when you use specific branchless assembly instructions, so it's not just performance

CPUs do not guarantee that branchless instructions always take the same amount of time.

CPUs guarantee what they guarantee, and if they guarantee that a certain instruction takes an operand-independent time then it does.

For example a RISC-V CPU implementing the Zkt extension is required to implement a whole bunch of logical and arithmetic integer operations with operand-independent timing. This includes the two "branchless move" instructions from the Zicond extension, czero.eqz and czero.nez.

Just to pick nits, the important thing is basically no secret-dependent { branches, loop bounds checks, memory accesses }. This is a lot more complex than simple "constant time."

Reply on news.ycombinator.com